On Wednesday, December 15, 2004, 16:37:44, A. Clausen wrote:
Due to a number of worms discovered on a number of our subscribers' computers we've been blocking outgoing port 25 connections for subscriber IPs.
Thank you.
I don't think we'll irritate too many customers, and we've had no choice considering the number of zombies on our system. Even with AV scanning, people are managing to pick up worms.
However, I'm seeing some activity on our firewall logs indicating some subscribes are attempting to send to what look like Hotmail SMTP servers. Is this how Hotmail on Outlook Express works? I always thought it was through http,
That's my understanding as well.
but perhaps I am just looking at another worm.
Do the logs show them attempting connections to other SMTP servers as well?
For the short term you could ignore it. If you don't get a support call from them within a few days its probably a worm and you could send them an e-mail strongly suggesting they deworm their system.
In the last few days I've noticed a few patterns. Yesterday it looked to me like the zombies were simply hitting IPs sniffing out hosts with port 25 open. Today it looks far more directed, and I've since seen attempts at what seem to be two other mail servers (yesterday the zombies were trying to nail consumer cable IPs and the like).
Worst of all, of course, was that one of our customers was infected and managed to be sending through our IMGate gateway. I've now turned off relaying for all local IPs, and have set it so only the IMail box can relay mail through the IMGate box. I'm not too sure how I can deal with another local zombie that starts puking stuff through the IMail box. Hopefully Declude can catch these.
It appears that some of our ip addresses are on at least one RBL <groan> because of this. It's been three straight Mondays in a row for me now.
-- A. Clausen [EMAIL PROTECTED]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
